Administrator Guide

Private VLANs (PVLAN)
The private VLAN (PVLAN) feature is supported on Dell Networking OS.
For syntax details about the commands described in this chapter, refer to the Private VLANs commands chapter in the Dell Networking OS
Command Line Reference Guide.
Private VLANs extend the Dell Networking OS security suite by providing Layer 2 isolation between ports within the same virtual local area
network (VLAN). A PVLAN partitions a traditional VLAN into subdomains identied by a primary and secondary VLAN pair. Private VLANs
block all trac to isolated ports except trac from promiscuous ports. Trac received from an isolated port is forwarded only to
promiscuous ports or trunk ports.
Example uses of PVLANs:
• A hotel can use an isolated VLAN in a PVLAN to provide Internet access for its guests, while stopping direct access between the guest
ports.
• A service provider can provide Layer 2 security for customers and use the IP addresses more eciently, by using a separate community
VLAN per customer and at the same time using the same IP subnet address space for all community and isolated VLANs mapped to
the same primary VLAN.
• In more detail, community VLANs are especially useful in the service provider environment because multiple customers are likely to
maintain servers that must be strictly separated in customer-specic groups. A set of servers owned by a customer could comprise
a community VLAN, so that those servers could communicate with each other, and would be isolated from other customers.
Another customer might have another set of servers in another community VLAN. Another customer might want an isolated VLAN,
which has one or more ports that are also isolated from each other.
Topics:
• Private VLAN Concepts
• Using the Private VLAN Commands
• Conguration Task List
• Private VLAN Conguration Example
• Inspecting the Private VLAN Conguration
Private VLAN Concepts
Review the following PVLAN concepts before you create PVLANs on your system.
The VLAN types in a PVLAN include:
• Community VLAN — a type of secondary VLAN in a primary VLAN:
• Ports in a community VLAN can communicate with each other.
• Ports in a community VLAN can communicate with all promiscuous ports in the primary VLAN.
• A community VLAN can only contain ports congured as host.
• Isolated VLAN — a type of secondary VLAN in a primary VLAN:
• Ports in an isolated VLAN cannot talk directly to each other.
• Ports in an isolated VLAN can only communicate with promiscuous ports in the primary VLAN.
• An isolated VLAN can only contain ports congured as host.
• Primary VLAN — the base VLAN of a PVLAN:
41
708 Private VLANs (PVLAN)